One of the most utilized networks for interconnecting distributed computer systems is the Internet. The Internet allows users of computer systems to exchange data throughout the world. In addition, many private networks in the form of corporate or commercial networks are connected to the Internet. These private networks are typically referred to as an “intranet.” To facilitate data exchange, the intranet generally uses the same communications protocols as the Internet. These Internet protocols (IP) dictate how data is formatted and communicated. In addition, access to corporate networks or intranets can be controlled by network gateways, which can include a firewall system.
As the popularity of the Internet grew, businesses turned to it as a means of extending their own networks. First came the intranet, which was an access-controlled site designed for use only by company employees. Now, many companies are creating their own VPN (virtual private network) to accommodate the needs of remote employees and distant offices. The VPN is generally a private network that uses a public network (usually the Internet) to connect remote sites or users together. Instead of using a dedicated, real-world connection such as a leased line, a VPN uses “virtual” connections routed through the Internet from the company's private network to the remote site or employee.
In a typical configuration, a local network uses one of the designated “private” IP address subnets (such as 192.168.x.x, 10.x.x.x or 172.16.x.x-172.31.x.x), and a router on that network has a private address (such as 192.168.0.1) in that address space. The router is also connected to the Internet with a single “public” address or multiple “public” addresses assigned by an ISP. As traffic passes from the local network to the Internet, the source address in each packet is translated on the fly from the private addresses to the public address(es). The router tracks basic data about each active connection (particularly the destination address and port). When a reply returns to the router, it uses the connection tracking data it stored during the outbound phase to determine where on the internal network to forward the reply.
The typical virtual private network gateway or device includes a secure communications over an open and typically insecure network such as the Internet. In order to establish secure communication between any two nodes on a virtual private network (VPN), each node obtains by some means information (“configuration”) including but not limited to: the identity and state of the remote nodes within the VPN, the relationships between nodes (VPN topology), and cryptography for authentication and data communications encryption between nodes. The secured communication between the two nodes is commonly called a “tunnel”, while the nodes themselves are often referred to as “tunnel terminators.” The traditional VPN solutions are comprised of a number of tunnel termination devices, which provide a central “hub” for VPN communication. Software is then deployed to nodes that wish to participate in a VPN, and the software is configured manually with the address of the VPN device(s), which is then executed in order to participate in the VPN. The traditional VPN solution exposes the internal network topologies of the two end VPN nodes. The client (requestor) and the resource (service) communicate with each other using their local IP addresses on their own VPN nodes respectively.
Accordingly, it would be desirable to have an application to application system, which can deploy any virtual resources (services) and those application level content can be routed through a virtual private network tunnel without disclosing local internal network topology.